Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am very technical, but I do not know much about fax. I was told to send a fax to somebody with some very private information, and not to worry because they had a secure fax line.

That's all well and good, but I do not have a secure fax line. Does this matter? Or am I in the right not wanting to send this data to them via fax.

share|improve this question
1  
I think this may have been addressed in a separate thread, or maybe I'm thinking of a chat conversation, or something else. In short, if you have to ask "is this line secure?", then the answer is "no". –  Iszi Nov 11 '11 at 4:13
    
With any telecommunication techology if one end of the conversation is not secure then the entire conversation is insecure. Without specialized equipment the line is not secure. You never made it clear what makes the secured endpoint secure. If you have documents if leaked would cause damage, have them mail you them, a fax is NOT secure. You could have them send them by email in an encrypted email, the fact somebody wants to send something, and you are worried about the secuirty tells me this isn't an option and you should just take the secured snail mail approach :) –  Ramhound Nov 14 '11 at 21:15

4 Answers 4

I wouldn't much care if the line were secure, I'd want the connection to be secure.

Consider the possible ways your data could be intercepted:

  • If you send from a fax machine at your office, the line could be tapped in the corporate wiring cabinet, or anywhere between the machine and the cabinet.
  • If you send from home, the line could be tapped at the network interface.
  • The line could be tapped between the network interface and the CO.
  • A rogue phone company employee could be listening.
  • A government could be listening ("lawful intercept").
  • The same set of taps could be in place between the CO and the receiver.
  • When the fax rolls off the receiver's machine, if the machine is not in a physically secure location (e.g. a locked office), then a casual snooper might see your info.
  • If the fax is stored electronically instead of printed directly onto paper, it could be "stolen" from the electronic storage system.

So the answer is no, the data is not secure. You need to be able to establish an encrypted connection to the receiver, and (if it is very sensitive) you want to understand how they will be handling the data once it has been received.

share|improve this answer

A chain is only as strong as its weakest link

Your fax communication is not secure if one of the participating hops is not secure.

If your fax machine does not support same encryption that somebody's fax machine then fax will go insecure (clear text) or will be blocked, depending on settings.

share|improve this answer

It's never a good idea to send private information in a fax, even though it seems like every single company requires it at some point. Fax communication cannot be secured without specialized hardware or software, so you cannot send from an insecure fax line to a "secure" line in any way that is secure end-to-end.

Whether or not this matters really depends on the information being sent. It also depends on how the fax is managed on the receiving end... does the fax just get stacked onto a pile of others that anyone can look through or what?

share|improve this answer

There's no such thing as a "secure line". Whoever fed you that line has watched too many movies.

Sending faxes is not a good strategy if you need strong security. Anyone who can eavesdrop on any of the phone lines involved, can eavesdrop on the contents of the fax. But a perhaps even bigger risk is that you don't know who is on the other end, how the fax is being handled, or whether your fax is going to the right place. It would be easy to screw up and (without realizing it) inadvertently send your fax to the wrong number. You also don't know what digital copies of the data may be inadvertently retained on your fax machine or their fax machine, or who may have access to that fax machine, or what may happen to it if it gets sold.

If it's "very private" information, I don't know if I'd use fax. I'd have to know more about what the information is or how severe the consequences are for inadvertent disclosure, and who might have an interest in tapping your phones -- but faxes have some inherent security limitations that are difficult to counter.

share|improve this answer
    
Your answer is all correct except for the first sentence. Secure lines do exist - but they are expensive to implement as they require specialised hardware, line encryptors etc., and the secure transmission of key materials is resource intensive. Generally they are only used by military and government. –  Rory Alsop Nov 11 '11 at 9:33
2  
My understanding is that it's not the line that's secure. Rather, you get a piece of crypto gear, and if the other endpoint also has compatible crypto gear, the two crypto devices can sync up and encrypt all your traffic. (Tell me if I've misunderstood.) I think a lot of people have a misconception about this; they imagine that if they had a "secure line", then they could call any random stranger on the phone and no one will be able to eavesdrop. However, it doesn't work that way in real life. In real life, both you and the other party have to have crypto gizmos. –  D.W. Nov 11 '11 at 9:55
    
Ahh - yes, we are on the same page here. The'secure line' comes from both ends having the encryptor. There may be the odd exception (perhaps US President to USSR - dunno) where there is a real dedicated encrypted line. –  Rory Alsop Nov 11 '11 at 9:58
    
The uh, USSR doesn't exist anymore ;) –  Steve Nov 11 '11 at 15:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.